Cyber criminals are exploiting the global focus on Covid-19 and the massive increase in working from home to infiltrate networks and extort money.
The extent was outlined in an Emergence Insurance webinar, themed a tale of two viruses, presented to 1,300 brokers and their clients on 20 May.
Emergence CEO Troy Filipcevic said ransomware perpetrators were no longer just encrypting data, but stealing it and demanding big ransoms to prevent the data being publicly released.
Emergence had paid two ransom demands on insureds’ behalf in just the past six weeks, including a Queensland-based claim for $350,000 in bitcoin.
That was the ransom alone; with Emergence yet to calculate incident response costs and business interruption.
Emergence Head of Underwriting & Product Development Jeff Gonlin said ransomware group REvil had attacked a New York law firm that represented many high-profile celebrities, including Lady Gaga and Madonna, stolen confidential business and personal information, posted some on the dark web, and was seeking a $US42 million ransom demand.
He said extortion was becoming more targeted and costly and recovery times were longer. “This ugly practice has gone to new levels and with new variants.”
Jeff detailed parallels between Covid-19 and cyber viruses. Neither has a cure, but Emergence’s Cyber Event Protection policy has been enhanced to reflect the emerging and evolving threat landscape.
Physical distancing to avoid contracting Covid-19 was equivalent to the “zero trust” attitude Emergence encouraged among insureds. “Assume everyone is a threat,” Jeff said.
“Masks are like firewalls but neither are fully reliable in preventing bugs from spreading. Anti-virus software is like a vaccine but, just as old vaccines don’t work against Covid-19, anti-virus software is ineffective against novel cyber viruses.
“Intrusion detection testing and threat intelligence are equivalent to Covid-19 testing; Emergence’s incident response team, which is available 24/7/365, is the ICU; and business interruption cover is the lifesaver, the ventilator,” Jeff said.
“Health insurance is vital for people and cyber cover is essential for business survival.”
New and enhanced features in Emergence’s fourth policy upgrade in as many years include:
- Preventive shutdown cover to enable insureds to take preventive measures before cyber events hit.
- A preventive shutdown allowance to compensate for lost earnings and increased costs, and provide independent security audits to assess threats.
- System failure cover is added to contingent business interruption to protect against failure of insureds’ IT infrastructure or IT infrastructure managed by external contractors.
- Expanded cyber extortion cover includes threats against data held in insureds’ systems or exfiltrated.
- Privacy error protection to counter human errors that can cause unauthorised disclosure of personally identifiable information, including non-electronic data.
- Identity-theft response costs to expand victim support from notification and monitoring to helping them re-establish their identities and records.
- The ID theft cover compensates individuals, including employees, from direct financial losses from ID theft.
The policy is split into four sections:
- business interruption
- response costs
- optional coverage for contingent business interruption, criminal financial loss, and tangible property. That enables brokers to tailor protection to clients’ needs.
Troy said Emergence’s 100% focus on cyber insurance meant it had significant expertise in the field and was committed to constantly evolving the product as new cyber risks emerged.
Emergence is an award-winning underwriting agency, exclusively focused on providing flexible, innovative cyber insurance solutions to help protect Australian businesses, ranging from SMEs to ASX-listed companies.
Emergence was judged the 2019 Insurance Business magazine Underwriting Agency of the Year and a finalist in the same category at the 2019 ANZIIF-Asia Insurance Review awards.
To access the broker portal to obtain Emergence cyber quotations for your clients, email firstname.lastname@example.org.